The latter. We didn't know about that bug until now, but we'll probably keep it this way so connections work with any VNC client people might have lying around.
I thought you could possibly be exploiting the bug unintentionally - a hacked together client that just attempts to connect with null auth would do it. Not sure how common that vuln is.